Real-time visibility
Identities, accounts and privileges — human and non-human — continuously updated.
Identity Rules
For SOC & MSSP
Identity intelligence for your SOC. A new service for your customers.
Strengthen your SOC with identity threat detection, and deliver a new managed security service: continuous Identity Risk Monitoring, incident investigation and one-time assessments.
"Identity security becomes a service, not a project."
The problem
Identity is the biggest blind spot in most SOCs
Most SOC tools see network, endpoint and malware — few see identity abuse.
What your SOC already sees
- Network threats
- Endpoint threats
- Malware activity
What it usually misses
- Identity abuse
- Privilege escalation
- Risky access changes
- Identity attack paths
Attackers don't hack systems anymore — they exploit identities.
Identity Intelligence for Security Operations
From identity data to actionable intelligence
Attack pattern detection
Recognizes MITRE ATT&CK techniques tied to identity before they escalate.
Immediate context
Who has access to what, since when and why. Speeds up every investigation.
AI-assisted analysis
Ask in plain language and dramatically reduce analysis time.
SOC use cases
Your SOC detects what was previously invisible
Full identity context for every security investigation.
Privilege escalation
Detect privilege-escalation attempts in AD, AWS IAM, databases and SaaS — before they become a breach.
Abnormal access changes
Spot unexpected access modifications (grants, additions to privileged groups, dormant-account reactivation).
Identity attack paths
Visualize privilege chains an attacker could leverage to move laterally.
Identity incident investigation
Full per-identity timeline — every account, privilege and recent activity — at the analyst's fingertips.
Integration
Complements your existing detection stack
Identity Rules plugs naturally into the operation you already have — it doesn't replace it.
- SIEM platforms
- SOC workflows
- Incident Response processes
- EDR / XDR
- ITSM / Ticketing
New managed services
Three services ready for your portfolio
Each monetizes separately — recurring or one-time — on the same platform.
Identity Risk Monitoring
Continuous monitoring of identity risk and privilege abuse across your customers' environments. Actionable alerts, CISO-ready dashboards, audit evidence.
- Continuous detection of risky access changes
- Month-over-month IAM attack-surface reduction
- Monthly customer reports
Identity Incident Investigation
Rapid analysis when an incident touches identity — leaked credentials, detected escalation, suspected compromised account. Your SOC gets the full context in minutes.
- Full per-identity timeline
- Affected privilege map
- Containment and remediation plan
Identity Risk Assessments
Deep identity risk diagnostic in a week. Prioritized findings, visible attack paths and a remediation plan that drives follow-on project sales.
- Inventory of human and NHI identities
- Severity-prioritized findings
- Actionable remediation roadmap
Commercial models
Flexible pricing aligned to customer risk
Managed Identity Risk Monitoring
Monthly or annual subscription
- Managed continuous monitoring service
- Pricing scales by Identity Units analyzed at the customer
- Recurring margin for the MSSP
- Auto-renewal + upsell into Investigation
Identity Risk Assessment
One-time engagement
- One-time consulting service
- Priced by customer identity scope
- Deliverables: report + remediation plan
- Natural gateway into recurring Monitoring
Value for MSSPs
Why MSSPs choose Identity Rules
Expand your portfolio
Identity security becomes a service you can sell today — without building it from scratch.
Grow recurring revenue
Subscription model aligned to the customer's identity surface — it scales as they grow.
Improve SOC detection
Your team catches threats it misses today — without changing existing tools.
No complex IAM rollouts
Forget six-month IGA projects — Identity Rules deploys and delivers value in days.
Getting started
From zero to first customer in four steps
- 1
Deploy Identity Rules
We hand you a POC tenant for a pilot customer.
- 2
Identify identity risks
You run an Identity Risk Assessment and deliver prioritized findings.
- 3
Convert the assessment
The customer signs for continuous Identity Risk Monitoring — recurring service.
- 4
Scale up
More identity units, more customers, more services. We back you with co-marketing and SOC enablement.
Become a partner
Offer identity security in under 30 days
Book 30 minutes with our partner team. We walk you through the model, enablement and first steps.